-1

Here is what i want to do:

I have a bunch of systems, some might have the same Public-IP, i disable ARP. I have a Firewall (either IP Layer or bridge-FW) between these systems and the internet. Depending on the destination port of incoming IP-Packets to some of these Public-IPs i want to set the destinsation-Ethernet-Adress. So for instance

System A has IP 8.8.8.8, mac de:ad:be:ef:de:ad, arp disabled System B has IP 8.8.8.8, mac 1f:1f:1f:1f:1f:1f, arp disabled

Firewall has IP 8.8.8.1, arp disabled on that interface

  1. Incoming packet to IP 8.8.8.8 tcp dest port 100
  2. Incoming packet to IP 8.8.8.8 tcp dest port 101

Firewall sets dest-mac for 1.) -> de:ad:be:ef:de:ad Firewall sets dest-mac for 2.) -> 1f:1f:1f:1f:1f:1f

Second scenario:

System A and System B establish outgoing TCP-Connections, and the firewall matches the dst-mac of the incoming IP-Packets (response packets) to the senders-mac address.

is this possible in any way with linux and iptables?

edit: i read ebtables might "work" in a hackish way for this purpose but i am not sure...

1
  • 2
    Looks to me like you're trying to solve what's already been solved several times over with a more elegant solutions.
    – hookenz
    Nov 28, 2012 at 20:50

3 Answers 3

2

What you're trying to do is called port-forwarding, and is typically done via NAT. (Incoming traffic on the public IP gets forwarded to a different private IP based on the port at which it arrives.)

Doing this via MAC address seems like an unnecessary complication.

6
  • i am well aware of port forwarding and NAT, but they are no options for me, because the end services have three requirements: 1.) they need to have a public IP and 2.) due to load balancing they may have different mac addreses 3.) due to limited public IPs several machines might have the same ip
    – d-fens
    Nov 28, 2012 at 16:41
  • Alright, well, good luck with that, then. IPv6, FTW. Nov 28, 2012 at 16:43
  • yeah ipv6 would obviously be the clean solution, unfortunately that doesnt help me atm because the services cant even use ipv6 yet
    – d-fens
    Nov 28, 2012 at 16:50
  • @d-fens Yeah, honestly sounds like you're just outta luck... I'd probably suggest to the suits that it would be a lot cheaper to buy more public IPs than to try to code through this... mess. Nov 28, 2012 at 16:59
  • @d-fens - mac addresses are not routed. It's irrelevant that the MAC is different.
    – hookenz
    Nov 28, 2012 at 21:14
1

Why get so complicated? Install a proxy or load balancer like haproxy and do everything at the layer 3 level.

1
  • i have services i load balance. these services must bind() to a public IP and even establish outgoing connections through this public IP. Due to load balancing the services might end up on different nodes. Due to oforementioned necessity of public IPs, different nodes might have the same ip, for example a service A and B has both bind() to 8.8.8.8 but service B was later migrated to another node.
    – d-fens
    Nov 28, 2012 at 16:44
0

One method which may work well for you is by using a the nth module in iptables. I haven't tested this but in theory you should be able to make this work.

For example:

Will load balance requests to port 100 to 2 internal servers.

iptables -A PREROUTING -i eth0 -p tcp --dport 100 -m state --state NEW -m nth --counter 0 --every 2 --packet 0 -j DNAT --to-destination 192.168.1.1:100

iptables -A PREROUTING -i eth0 -p tcp --dport 100 -m state --state NEW -m nth --counter 0 --every 2 --packet 1 -j DNAT --to-destination 192.168.1.2:100

By the way, firewall can still have 8.8.8.1 address if you like and also 8.8.8.8. You can write NAT rules so that traffic coming from those servers exiting the firewall will use 8.8.8.8 as their source. Any other traffic behind the firewall can use 8.8.8.1 as the source.

Something like the following may work.

iptables -t nat -A POSTROUTING -s 192.168.1.0/30 -o eth0 -j SNAT --to-source 8.8.8.8

Where only ip's from 192.168.1.0 - 192.168.1.3 are allowed. i.e. your servers

And for the rest of the network

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 8.8.8.1

Yeah I know, the 30 range is inside the 24 range. iptables will hit the first rule and NAT to 8.8.8.8 (I think).

3
  • Nat is not going to work unfortunately, because the services use the bind() socket parameters to propagate the service to third party directories. For instance if i use 192.168.x.x that IP would be propagated to the lookup directory, regardless what kind of NAT-foo i make.
    – d-fens
    Nov 29, 2012 at 10:30
  • ok, can you change that logic? what happens when you need to change public IP? isn't this all going to come crashing down in a big heap?
    – hookenz
    Nov 30, 2012 at 0:01
  • What about putting each machine in a different VLAN bound to the same IP? then you can route by VLAN
    – hookenz
    Nov 30, 2012 at 0:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .